lundberg/porchlight
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

create unprivileged user

Browse source 
run uvicorn directly instead of via uv
This commit is contained in:
Johan Lundberg 2026-07-19 23:17:54 +02:00
parent 1f94334334
commit ac06e56217
1 changed files with 13 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

15
Dockerfile
View file

@ -41,10 +41,21 @@ COPY README.md ./
COPY src/ src/ COPY src/ src/
RUN uv sync --frozen --no-dev RUN uv sync --frozen --no-dev
ENV OIDC_OP_ISSUER=http://localhost:8000 # Use the venv built above directly — avoids `uv run` re-syncing (and
# needing network access to re-resolve/rebuild) at container startup.
ENV PATH="/app/.venv/bin:$PATH"
RUN groupadd --system porchlight \
&& useradd --system --gid porchlight --home-dir /app porchlight \
&& mkdir -p /app/data \
&& chown porchlight:porchlight /app/data \
&& mkdir -p /app/config \
&& chown porchlight:porchlight /app/config
USER porchlight
EXPOSE 8000 EXPOSE 8000
CMD ["uv", "run", "uvicorn", "porchlight.app:create_app", \ CMD ["uvicorn", "porchlight.app:create_app", \
"--factory", "--host", "0.0.0.0", "--port", "8000", \ "--factory", "--host", "0.0.0.0", "--port", "8000", \
"--workers", "4"] "--workers", "4"]